Crash in InlineBox::deleteLine due to accessing removed renderer.
authorAdemar de Souza Reis Jr <ademar.reis@openbossa.org>
Wed, 31 Aug 2011 17:22:38 +0000 (14:22 -0300)
committerAdemar de Souza Reis Jr <ademar.reis@openbossa.org>
Wed, 31 Aug 2011 18:48:52 +0000 (15:48 -0300)
commitb1e2f8114848070530774f516d55c6f4a72eb803
tree6dfae4ca2f164f08d3d79d8035db12495274a7cd
parent5700b2559f5bbada054c4df4215d0155b2fe0dac
Crash in InlineBox::deleteLine due to accessing removed renderer.
https://bugs.webkit.org/show_bug.cgi?id=66015

Author: Abhishek Arya <inferno@chromium.org>
Reviewed by Simon Fraser.

Source/WebCore:

Test: fast/block/line-layout/inline-box-wrapper-crash.html

* rendering/RenderBox.cpp:
(WebCore::RenderBox::positionLineBox): Make sure that the
previous inline box wrapper is destroyed properly, before
setting a new one.

LayoutTests:

* fast/block/line-layout/inline-box-wrapper-crash-expected.txt: Added.
* fast/block/line-layout/inline-box-wrapper-crash.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@94001 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Conflicts:

Source/WebCore/rendering/RenderBox.cpp
LayoutTests/ChangeLog
LayoutTests/fast/block/line-layout/inline-box-wrapper-crash-expected.txt [new file with mode: 0644]
LayoutTests/fast/block/line-layout/inline-box-wrapper-crash.html [new file with mode: 0644]
Source/WebCore/ChangeLog
Source/WebCore/rendering/RenderBox.cpp